The Real Estate Papi WordPress theme up to version 1.0.5 fails to validate that the requesting user has the correct capability and does not check for a valid CSRF token on an AJAX endpoint. This omission permits any authenticated user, including subscribers, to trigger the installation of a fixed set of companion plugins from the WordPress.org repository. If the request is made while a user with plugin activation rights is logged in, those plugins are also automatically activated. Because the installed plugins run with the privileges of the site owner, an attacker who controls even a low‑privilege account could use this path to install malicious code that runs with administrative rights.

Any WordPress site that has the Real Estate Papi theme in a version equal to or less than 1.0.5 is impacted. The theme is listed as "Unknown: Real Estate Papi" and interacts with the platform’s AJAX subsystem to manage plugin installation. No additional vendor or product information is available beyond the theme name and version range.

The flaw requires only authentication and benefits from missing CSRF and capability validations, making it relatively easy for an attacker with a subscriber account to trigger plugin installation. The EPSS score of 0.00097 indicates a low but non‑zero exploitation probability, and the vulnerability is not listed in the CISA KEV catalog. Once a malicious plugin is installed and activated, it can execute code with administrative privileges, potentially compromising confidentiality, integrity, and availability of the entire WordPress installation. The CVSS score is 4.3.